EUVD-2025-208829Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function lacks CSRF token validation and directly processes user-supplied userId and groupId parameters via getUserManager().createUserInGorup(), enabling malicious websites to forge requests that automatically execute when an authenticated administrator visits a crafted page. Adding a user to the Super Admins group (s2 user) is not possible. Successful exploitation results in the attacker gaining privilege escalation both horizontally to other groups and vertically to the admin group. Escalation to the s2 User group is not possible.
AnalysisAI
MuraCMS through version 10.1.10 contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management Add To Group functionality that allows attackers to escalate privileges by adding authenticated users to arbitrary groups without proper authorization validation. An authenticated administrator visiting a malicious webpage can be tricked into adding any user to the Admin group or other privileged groups, though escalation to the Super Admin (s2) group is blocked. This vulnerability enables both horizontal privilege escalation across different user groups and vertical privilege escalation to administrative roles, posing a significant risk to multi-user MuraCMS installations where administrator accounts are targeted.
Technical ContextAI
The vulnerability exists in the cUsers.cfc component's addToGroup method, which handles user group assignment within MuraCMS—a content management system built on ColdFusion/CFML technology. The vulnerable function directly processes userId and groupId parameters submitted via HTTP requests and passes them to the getUserManager().createUserInGroup() backend function without implementing CSRF token validation or cross-request verification. This represents a classic CWE-352 (Cross-Site Request Forgery) issue compounded by insufficient authorization checks (related to CWE-284). The lack of CSRF protection means that state-changing operations (group membership modification) can be initiated from external websites, violating the same-origin policy enforcement that should protect administrative operations. The addToGroup method fails to verify that the request originated from a legitimate MuraCMS admin interface and lacks server-side session binding to validate request authenticity.
RemediationAI
Upgrade MuraCMS to a patched version released after 10.1.10; consult the vendor release notes at https://docs.murasoftware.com/v10/release-notes/ for the specific fixed version number and deployment instructions. As an immediate interim control pending patches, administrators should implement CSRF token validation by adding a CFML-level token check to the addToGroup function in cUsers.cfc, requiring that all user group modification requests include a cryptographically random, session-bound token generated by the application and verified server-side before processing. Additionally, restrict administrative access to the MuraCMS admin interface using network-level controls (IP whitelisting, VPN requirements) and enforce same-site cookie policies (SameSite=Strict) on all session cookies to mitigate cross-site request exploitation. Monitor group membership changes via audit logs and enforce multi-factor authentication for administrative accounts to reduce the impact of compromised admin sessions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today